Company is showing signs of improvement, past flaws took it up to a year to patch

Famed OS X hacker Charlie Milleronce told a security blog, "Mac OS X is like living in a farmhouse in the country with no locks, and Windows is living in a house with bars on the windows in the bad part of town."

Kapersky Labs, a top security firm recently warned the public that Apple's security was 10 years behind Microsoft Corp.'s (MSFT). Evidence of that was seen in the 10.7.3 build of OS X "Lion", which due a programming error (a stray debugging flag left on in OS X's source) accidentally logged in plaintext the passwords of users who used legacy FileVault settings.

An Apple user, Eric Hildum complained in the support forums three months ago:

I’ve tried it on another Mac as well, same result: The login of a normal network user writes this log line as his homedir gets mounted.
This poses a security risk. We have some users who are local admins, they could ask another user to login on their Mac and look for the password afterwards. Extration in single user mode would be possible as well.

Is this a “speciality” of our environment or is this a known bug? Can I turn this behavior off?
We are running Lion clients with a SL Server and using OpenDirectory.

Apparently the Apple answer was that this was a "feature" for the time being, because the user received no reply to his pleas for three months. Then a security researcher by the name of David Emery, posted his findings to the Cryptome mailing list, a list frequent by hackers.

As noted by Mr. Emery, the issue did not effect purchasers of new Lion systems, but might have affected many users of legacy systems who upgraded to Lion.

With the Cryptome email, the media began to catch wind of Lion's penchant for plaintext password dumping and Apple was forced into the awkward position of providing an "update" for its "feature".

The patch also "improves" other "features", such as no longer losing settings to the "reopen windows when logging back in" checkbox, and allowing "certain British third-party keyboards" to finally work.

Apple may still be living in the dark ages of security, but at least it's figured out not to stores users' passwords in plaintext, even if it took the company three months of complaints. On the plus side, the three month turnaround is faster than past incidents where Apple took up to a year to fix past security issues/features.

Comments

Threshold

Username

Password

remember me

This article is over a month old, voting and posting comments is disabled

Charlie Miller's comment may not be relevant but Kapersky's certainly is. Kapersky is saying Apple's security process is where Microsoft's was when XP was released. That puts them 10 years behind in their security process. How can you be okay with a bug that stores network and local passwords in plain text in an unencrypted area of the drive that goes for 3 months without being patched? You'd be standing outside Redmond with pitchforks and torches. But you can defend Apple?

How can you defend a Java bug that resulted in over 600k infections that was fixed for over 3 months before Apple updated the version they won't allow Sun to update directly? And 600k is roughly 1% or so of the OS X install base. I know what you're thinking, 1% isn't bad. To put that into context 12 million Windows infections would be 1% of the Windows install base. The last major virus that hit Windows that didn't require direct user intervention to spread? Conficker. It affected around 2-3% of the Windows install base. However it exploited a vulnerability that had been fixed for almost 6 months before the Conficker worm hit. So that's end user or IT stupidity/laziness.

Microsoft has one of the best security practices in computing today. Do they respond as fast as Linux? No, but they also have validation and extensive testing of patches. Linux users have to worry about a patch casuing issues with other programs that are dependant on files that have changed. It's very unusual for the MS patches to cause widespread problems. They are easily 10 years ahead of Apple and MS actually discloses the information when the patch is released so IT staff can determine testing order and deployment priority.